chore: Apply security best practices

[step-security-bot]

Summary

This pull request is created by StepSecurity at the request of @npalm. Please merge the Pull Request to incorporate the requested changes. Please tag @npalm on your message if you have any questions related to the PR.

Security Fixes

Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access. See how popular open-source projects use Harden-Runner here.

Harden runner usage

You can find link to view insights and policy recommendation in the build log

Please refer to documentation to find more details.

Keeping your actions up to date with Dependabot

With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF).

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Add Dependency Review Workflow

The Dependency Review Workflow enforces dependency reviews on your pull requests. The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, and warns you about the associated security vulnerabilities. This gives you better visibility of what's changing in a pull request, and helps prevent vulnerabilities being added to your repository.

• Github Guide about Dependency Review
• Github Guide for Configuring Dependency Review Action

Feedback

For bug reports, feature requests, and general feedback; please email [email protected]. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot [email protected]

[Copilot]

Pull Request Overview

This PR applies security best practices by restricting token permissions and hardening GitHub Actions runners across CI workflows.

• Enforces least-privileged GITHUB_TOKEN scopes where supported
• Inserts step-security/harden-runner in all jobs to audit outbound calls
• Adds a new Dependency Review workflow

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/update-docs.yml	Added root permissions and Harden-Runner step
.github/workflows/terraform.yml	Inserted Harden-Runner step in all Terraform jobs
.github/workflows/stale.yml	Inserted Harden-Runner step before the stale action
.github/workflows/semantic-check.yml	Inserted Harden-Runner step before the checkout step
.github/workflows/release.yml	Added root permissions and Harden-Runner step
.github/workflows/packer-build.yml	Inserted Harden-Runner step before the checkout step
.github/workflows/ossf-scorecard.yml	Inserted Harden-Runner step before the checkout step
.github/workflows/lambda.yml	Inserted Harden-Runner step before the checkout step
.github/workflows/dependency-review.yml	New workflow with root permissions, Harden-Runner, and checkout
.github/workflows/codeql.yml	Added root permissions and Harden-Runner step

Comments suppressed due to low confidence (8)

.github/workflows/codeql.yml:30

• The Harden-Runner step appears misaligned under steps: in codeql.yml; adjust its indentation to match other steps and prevent YAML parsing errors.

    - name: Harden the runner (Audit all outbound calls)

.github/workflows/terraform.yml:1

• This workflow lacks a top-level permissions block to scope GITHUB_TOKEN; consider adding permissions: contents: read to follow least-privileged token practice.

name: "Terraform checks"

.github/workflows/stale.yml:1

• This workflow is missing a root-level permissions block to limit the GITHUB_TOKEN scope; consider adding permissions: contents: read at the top.

name: "Stale issue and PR workflow"

.github/workflows/semantic-check.yml:1

• Add a root-level permissions block (contents: read) to restrict GITHUB_TOKEN to read-only, following the least-privilege recommendation.

name: "Semantic Check"

.github/workflows/packer-build.yml:1

• Include a top-level permissions: contents: read block to tighten the GITHUB_TOKEN scope for this workflow.

name: "Packer checks"

.github/workflows/ossf-scorecard.yml:1

• This workflow should declare permissions: contents: read at the root to enforce least-privileged token usage.

name: OSSF Scorecard supply-chain security

.github/workflows/lambda.yml:1

• Add a root-level permissions block (contents: read) to enforce least-privileged GITHUB_TOKEN access in this workflow.

name: Build lambdas

.github/workflows/update-docs.yml:20

• [nitpick] Consider extracting the Harden-Runner step into a reusable workflow or YAML anchor to avoid duplicating identical steps across multiple workflows.

      - name: Harden the runner (Audit all outbound calls)

[rjaegers]

For now this is great, but do note that eventually you will want to change the egress-policy to 'block' for (most of) the workflows, with an allow-list. This works best after StepSecurity has established a stable baseline.

Next to that it is also possible to disable sudo or both sudo and containers by using disable-sudo and disable-sudo-and-containers when jobs don't require that.

[npalm]

For now this is great, but do note that eventually you will want to change the egress-policy to 'block' for (most of) the workflows, with an allow-list. This works best after StepSecurity has established a stable baseline.

Next to that it is also possible to disable sudo or both sudo and containers by using disable-sudo and disable-sudo-and-containers when jobs don't require that.

Would be great if you can make a step in this direction in a separate PR.